docs: record #21 in features.md for v0.4.1-relyt.5

features.md

@@ -66,3 +66,10 @@ Feature history of this fork, by PR merge date.
 
 - features: Deactivating and deleting a user are now separate operations. Deactivation is reversible and leaves grants, owned objects and the email untouched; purging (`DELETE ...?purge=true`) is the irreversible one and the only thing that frees an email for reuse, guarded by typing the principal back, requiring the account to be deactivated first, refusing your own and the bootstrap administrator, and requiring an heir when the user owns securables -- those objects change hands as part of it. `GET .../ownedObjects` lists what is at stake beforehand. Metastore administrators can be appointed and stood down from the Users page, under the invariant that at least one *enabled* administrator always remains. The Users list separates active from deactivated accounts and carries each one's state.
 - bugfix: `PATCH /scim2/Users/{id}` carried no authorization annotation, and the access decorator lets a method without one through -- any signed-in account could deactivate any other, an administrator included; it now requires metastore OWNER. The administrator password sign-in never consulted the user table, so a deactivated `admin` still received a session whose every request was then refused; it now checks the account exists and is enabled. The bootstrap administrator could be deactivated by three separate routes and stripped of its administrator status, either of which closes the password sign-in that is the way back in when the identity provider is unavailable. The PatchOp schema typed `value` as a boolean, so the UI sent a scalar where RFC 7644 3.5.2.1 requires an object and the SCIM library rejected it while parsing; both forms the RFC allows are now accepted. In the UI, choosing any action from a user's menu -- or clicking inside a dialog it opened -- also opened the user drawer behind it. Test servers raced for their port, failing whole test classes with `Address already in use` on a loaded runner (this is what turned `test (Spark 4.1.0)` red on `main` after #17).
+
+## 2026-10-08
+
+#21 (https://github.com/relytcloud/unitycatalog/pull/21)
+
+- features: —
+- bugfix: Behind a reverse proxy that serves this server under a path prefix and strips it before forwarding, hosted login failed at the callback with "Missing login state". `/auth/login` scoped the `UC_OAUTH_STATE` cookie to the mount path the server sees (`/api/1.0/unity-control/auth`), while the browser comes back to `/callback` under the prefix, so the cookie was never sent. The state cookie is now set and cleared on the path the browser actually uses -- the path of `server.external-url` followed by the mount path -- which is the directory of the `redirect_uri` the provider is handed. Deployments whose `server.external-url` carries no path are unaffected, and `UC_TOKEN` stays at `Path=/`. Reaching this through the bundled deploy scripts additionally needs #22, which lifts the host-only check `deploy-uc.sh` applies to `UC_EXTERNAL_URL`.